PT-2007-4694 · Webapp · Webapp

Published 2007-06-26 · Updated 2008-11-15 · CVE-2007-3423

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions WebAPP versions prior to 0.9.9.7

Description The issue concerns the cgi-bin/cgi-lib/instantmessage.pl script in WebAPP, where the From field of an instant message is used as part of the .dat file name when certain functions read specific types of messages. This has unknown impact and can be exploited remotely.

Recommendations For versions prior to 0.9.9.7, update to version 0.9.9.7 or later to resolve the issue.

Fix

Related Identifiers

CVE-2007-3423

Affected Products

Webapp

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2007-3423 · Security Note
• http://web-app.org/downloads/WebAPPv0.9.9.7.zip · Patch
• http://web-app.org/cgi-bin/index.cgi?action=forum&board=how_to&op=display&num=9458 · Note
• http://osvdb.org/45409 · Note